This vulnerability in ThemeREX Tuning arises from improper validation or control of filenames used in PHP include/require statements, leading to PHP Local File Inclusion. An attacker could exploit this to include local files on the server, potentially leading to code execution or information disclosure. The affected versions are up to 1.3. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to include and execute arbitrary local files on the server running ThemeREX Tuning, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized access to sensitive data, code execution, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided at this time. Users should monitor ThemeREX advisories for updates and consider restricting access to vulnerable installations until a fix is available.